b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05/01/2024, 11:58

Target

b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll
Size

397KB
MD5

f19bbb56af51461046430a74d0d67655
SHA1

1ac809b04e7402c74cd8af92af20173e1c117286
SHA256

b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0
SHA512

e6d4bfa89d0bfcbed1d10762450d61dbca5bede3a7c69d225dbdf4f69e9cefc1e28435c8a2ca90d3966799efff90fb55d1887dd79fa352d4a82706d5d18618ac
SSDEEP

6144:151sacsiu2LDeIHoMDIbGFtcEOkCybEaQRXr9HNdvOar:174g2LDeiPDImOkx2LIar

Score

1^/10

Suspicious behavior: EnumeratesProcesses 4 IoCs

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	rundll32.exe
Token: SeTcbPrivilege	1220	rundll32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28
PID 1280 wrote to memory of 1220	1280	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\b2893ac98f79b4ef44867c41de1ffca232c6b2eade5536c36a70f22d15c16ca0.dll,#1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1220